Cyber Engineer – Endpoint Security MDX - SSFB

Amentum•Colorado Springs, CO

23h•Onsite

About The Position

The Cyber Engineer – Endpoint Security is part of Amentum’s Missile Defense Division and directly supports the Missile Defense Agency (MDA) as part of the MDSEA Cyber Team. The role is the primary endpoint-security engineering position supporting Elastic Defend and is responsible for endpoint-security engineering, administration, operational sustainment, troubleshooting, and modernization. The engineer works with cybersecurity, systems engineering, infrastructure, and mission stakeholders to ensure endpoint-security capabilities meet mission, operational, and security requirements. Limited backup, surge, and project-based support for enterprise Elastic engineering may also be assigned as mission priorities require. The position is based at Schriever Space Force Base in Colorado Springs, Colorado. It is not available for remote or telework, requires an active DoW Top Secret clearance with SCI eligibility, and involves day-shift work and travel up to 10% of the time. Relocation assistance is not available. Resumes must be submitted in month-and-year format. The selected candidate may be assigned as an employee of a teammate company. The posted compensation range is $155,000–$175,000. Actual compensation may vary based on responsibilities, education, experience, skills, internal equity, market data, applicable agreements, and relevant laws. Benefits include health, dental, and vision insurance; paid time off and holidays; retirement benefits including 401(k) matching; educational reimbursement; parental leave; employee stock purchase plan; tax-saving options; disability and life insurance; and pet insurance. Benefits may vary based on employment type, location, and applicable agreements.

Requirements

At least 8 years of general full-time work experience; this may be reduced with completion of advanced education.
At least 6 years of directly related experience.
At least 2 years of experience working in a management or leadership role.
Current DoW 8570.01-M IAT Level II certification, such as CompTIA Security+.
Experience administering, configuring, troubleshooting, deploying, or sustaining enterprise endpoint-security tools in a DoW or similarly regulated environment.
Experience with cybersecurity processes, procedures, and tools for endpoint protection, vulnerability management, monitoring, logging, or data correlation, such as Trellix ESS/ePO, ACAS, Elastic, ArcSight, or comparable technologies.
Active DoW Top Secret security clearance with SCI eligibility.

Nice To Haves

Experience deploying, configuring, and using Elastic Kibana visualization dashboards for cybersecurity monitoring, analysis, reporting, and operational awareness.
Experience using and configuring Elastic Cloud features, including X-Pack security, alerting, monitoring, reporting, and role-based access controls.
Experience developing, configuring, and customizing Elastic/ELK Stack components, including Elasticsearch, Logstash, and Kibana, for enterprise monitoring, log aggregation, visualization, alerting, and cybersecurity operations.
Hands-on experience with Elastic Defend, Elastic Security, Elastic Stack, Elastic Cloud Enterprise, or comparable enterprise SIEM or EDR capabilities.
Experience supporting Prisma Cloud and container-security capabilities, including container and image vulnerability management, compliance monitoring, runtime protection, alerting, troubleshooting, and integration with enterprise cybersecurity monitoring processes.
Basic working knowledge of Linux, including command-line navigation, file and directory management, permissions, process and service monitoring, log review, package management, and basic troubleshooting.
Experience with Trellix Endpoint Security Suite, Trellix ePolicy Orchestrator (ePO), HBSS, or comparable endpoint-security management platforms.
Experience supporting cybersecurity-tool migrations, endpoint-security platform transitions, agent migrations, policy conversion, testing, validation, or operational rollout.
Familiarity with DoW cybersecurity operations, vulnerability management, DISA Cyber Tasking Orders (CTOs), Information Assurance Vulnerability Alerts (IAVAs), STIGs, and continuous-monitoring activities.
Familiarity with RMF processes, NIST SP 800-53 controls, security documentation, and ATO sustainment activities.
One or more advanced certifications, such as CompTIA CySA+, CASP+, CISSP, GIAC certifications, or other advanced DoW 8570-aligned certifications.
Experience supporting enterprise engineering teams through technical integration, logging and telemetry onboarding, troubleshooting, implementation projects, or operational surge support.
Demonstrated ability to work independently, manage competing priorities, collaborate across technical teams, and support mission-critical operations.

Responsibilities

Administer, configure, maintain, troubleshoot, and sustain endpoint-security tools and services supporting mission systems and DoW cybersecurity requirements.
Support endpoint-security operations using Elastic Defend, including configuration, policy management, agent deployment and health, alerting, troubleshooting, logging, reporting, and coordination with system owners and administrators.
Investigate and resolve endpoint-security tool issues and support endpoint policy management, agent deployment and health, alerting, logging, and reporting.
Develop and maintain endpoint-security engineering documentation, including SOPs, configuration baselines, implementation plans, troubleshooting guides, and sustainment artifacts.
Coordinate with cyber compliance, vulnerability-management, and system-administration personnel to support cybersecurity requirements, directives, remediation actions, and continuous-monitoring activities.
Collaborate with Cyber team leads, ISSMs, system administrators, network engineers, and Systems Engineering personnel to ensure endpoint-security capabilities support mission, operational, and security requirements.
Provide backup, surge, and project-based support for enterprise Elastic engineering, including technical coordination, configuration assistance, troubleshooting, documentation, integration activities, and designated implementation projects as mission priorities require.
Develop clear technical documentation and communicate effectively with cybersecurity personnel, system administrators, engineers, management, and mission stakeholders.